---
title: "Vend catalog credentials"
method: POST
path: "/catalogs/{name}/credentials"
---

# Vend catalog credentials

`POST /catalogs/{name}/credentials`

Mints a short-lived OAuth bearer token for browser or SDK access to a managed (tower-catalog) catalog. Defaults to read-only (`mode: "read"`); pass `mode: "read-write"` in the body (requires the catalogs:data:write scope) for a token bound to the read-write principal. Team membership is enforced before vending; the master Polaris credentials never leave Tower.

## Path parameters

- `name` string, required — The name of the catalog.

## Query parameters

- `environment` string — Environment whose catalog credentials to vend. When it has no same-named catalog, credentials for the catalog from default are vended instead.

## Request body

- VendCatalogCredentialsBody
  - `$schema` string, uri — A URL to the JSON Schema for this object.
  - `mode` 'read' | 'read-write' — Access level for the vended token. "read" (default) binds the token to the catalog's read-only principal; "read-write" requires the catalogs:data:write scope and binds it to the read-write principal.

## Response `200`

OK

- VendCatalogCredentialsResponse
  - `$schema` string, uri — A URL to the JSON Schema for this object.
  - `credentials` CatalogCredentials, required
    - `catalog_uri` string, required — The Iceberg REST catalog endpoint.
    - `expires_at` string, date-time, required — When the OAuth token expires.
    - `mode` string, required — Access level the token is bound to.
    - `oauth_token` string, required — Short-lived OAuth bearer token.
    - `warehouse` string, required — The Polaris catalog identifier (REST prefix).
  - `environment` string, required — Environment containing the catalog definition.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Unprocessable Entity
- `500` — Internal Server Error

---

[API](https://skmtc.net/tower/apis/tower-api.md) · [All operations](https://skmtc.net/tower/apis/tower-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tower/tower-api/revisions/0e42b0fb26d9/schema)